Query Wizard and Query Filter Bar (Devices)
- 7 minutes to read
The Axonius Query Wizard lets customers create granular queries to understand how devices and users adhere to their polcies.
Working with the Query Wizard
While in the Devices screen, you can click Query Wizard on the top right corner above the Devices table to open the popup dialog that allows you to define multiple filters. Defining filters in the Query Wizard allows you to easily drill down to the assets that match the required search criteria.
Here is an example of using the Query Wizard to show only Windows device assets that have been seen in the last 7 days using filters where the value of the General field OS: Type equals Windows and the value of the General field Last Seen is within the last 7 days.
Each row in the query wizard is a filter expression that consists of the following elements:
- AND / OR switch
- NOT Flag
- Object Flag
- Adapter pulldown
- Field pulldown
- Operator pulldown
- Value field
- Bracket controls
1. AND / OR Switch
This switch is only shown on the second and subsequent filter rows. When you have more than one filter defined, this allows you to control whether all filters are required to match, or if just one filter can match.
2. NOT Flag
This flag allows you to negate the filter line, and only match assets that do NOT match the adapter, field, operator, and value specified.
3. Adapter pulldown
This pulldown contains a list of all adapters that have fetched data for assets. The adapter that is selected in this pulldown controls the list of fields displayed in the Field pulldown. You can quickly search for adapters using the search bar at the top of this pulldown.
The first entry and default selection in this pulldown is General with a icon. All of the fields for General are the collated values from all of the data that has been fetched for all adapters.
You can control the adapter data sources that are used when evaluating a filter for a General field. By default, all adapters are selected. If you choose to only evaluate the operator and value query data in a General field from a subset
The adapter source of a General Data field can be specified. If specified, the icon will be replaced by , to indicate that specific sources have been selected. By default, all adapter sources are queried.
The adapter source of a General field can be specified. If specified, the icon will be replaced by , to indicate that specific sources have been selecteds. By default, all adapter sources are queried.
4. Field pulldown
This pulldown contains a list of all the fields that have been fetched for a specific adapter. In the case of the General selection in the Adapter pulldown, this is a list of all fields whose data is collated from all adapters.
Select the General Data field option ( icon, default option) to search any generic field. Generic fields are device properties retrieved from multiple adapters.
Click the Field drop-down list to select the device property to be queried. Use the search bar to search for a specific field name.
Once a field is selected, you need to select a comparison function from a drop-down list. For each field type there is a list of possible functions:
- Enumerated – 'equals' function along with a selection of a values from a list of pre-defined values
- Text – 'contains', 'equals', 'in', 'starts' and 'ends' functions, all refer to a text value to compare to.
- When choosing 'in', the text value should be a comma-separated list of values.
- When choosing 'in', the comma (,) character can be escaped by using double backslash (e.g \\,)
- Numeric – 'equals', '>' (greater) and '<' (lesser) functions, all refer to a numeric value to compare to.
- Date – '>' (after), '<' (before) and 'days' functions, all refer to a date expression to compare to.
When choosing '<' or '>' the value to compare is a chosen calendar date expression. When choosing 'days' the value to compare to is a relative absolute number of days (integer).
For example, means devices seen in the last 7 days.
- IP – 'size', 'exists', 'in subnet', 'not in subnet', 'contains', 'equals', 'isIPv4' and 'isIPv6' functions, all refer to an IP address value to compare to.
- Version - 'contains', 'equals', 'earlier than', 'later than' functions, all refer to a version value to compare to.
Specify the value to be compared by the field and function. Different relevant value options will be enabled according to the field type and the operator/function chosen.
- NOT - Used to exclude results. For example, means that Axonius will return all devices EXCEPT the devices where the OS type is Windows (including devices where the OS type is unknown or this field doesn’t apply, and not just devices that their OS type is defined and NOT Windows).
- And/Or Logical operators between expressions – Use “and” or “or” logical operators when adding multiple expressions to the query filter, to notate on the logical condition relation between 2 expressions.
- Parentheses -Use parentheses to group operands with their correct operator, just like in arithmetic. Also, like arithmetic operators, logical operators have precedence that determines how things are grouped in the absence of parentheses.
- OBJ - Use to query a specific object within a device object property. OBJ expressions may refer to multiple fields under the same object property with AND operator between them.
For example, the query below will display all devices that have Google Chrome with version 74:
While the query below will display all devices that have Google Chrome installed and ANY installed software which its software version is 74. The results may be different.
Expression Indicative Error
When an error occurs for a given expression, an indicative text referring to that error appears in red in the bottom of the Query Wizard. Use it to correct the expression.
For example, missing right bracket:
When completing a filter expression, the contents of the Devices table is refreshed with the results of your query. When done building the query expression click "Search". The final query expression is displayed in the Query Filter Bar. Click "Clear" to clear all expressions on the wizard, which will also clear the saved query, if used, and will refresh the Devices table and will display all existing devices.
You can always toggle back to the Query Wizard, change and refine the query, and create a multi-filter expression, by adding AND/OR operators between them:
- To add new expression, click
- To remove expression, click
For each added or removed expression the Devices table results are dynamically updated.
Free Text Search in Table
You can search and filter devices by typing text in the Query Bar. Pressing Enter filters all entities in the table that contain the given text in any properties. The search is case sensitive.
Alternatively, You can change and refine an existing filter directly from the Query Filter Bar.
All actions performed in the Query Filter Bar are tracked and stored. You can reuse or browse query filter history from the Query Filter Bar drop-down list a s shown in the figure below
Using a Saved Query as a Filtering Condition in Query Wizard Expressions
You can use a saved query to create complex queries based on pre-defined queries.
Include Outdated Adapter Devices in Query
By default, the Axonius query mechanism doesn’t include outdated or duplicate adapter records (that exist in the original device information source).
The 'Include Outdated Adapter Devices in Query' toggle button is an advanced option that allows you to include such records in the query results. For example, using this option in the following query may result with devices which have outdated Carbon Black CB Defense adapter records where 'Sensor Version' equals 18.104.22.168, although there is a more updated (newest last seen) record which its 'Sensor Version' is greater than 22.214.171.124.